Merge remote-tracking branch 'origin/v2/main' into v2/fix/2172-oidc-discovery-compat

Signed-off-by: cliffhall <cliff@futurescale.com>

# Conflicts:
#	README.md
#	core/mcp/inspectorClient.ts
#	test-servers/src/test-server-oauth.ts

clients/cli/src/cli.ts

@@ -108,6 +108,7 @@ async function callMethod(
   callbackUrlConfig: RunnerOAuthCallbackConfig,
   storedAuthOnly: boolean,
   relogin: boolean,
+  revoke: boolean,
 ): Promise<void> {
   // Clear after parse-time validation so a bad flag combo never deletes store
   // entries. Deletes the shared URL-keyed OAuth entry (not "ignore for this run").
@@ -117,7 +118,18 @@ async function callMethod(
         "--relogin requires an HTTP/SSE server URL (no OAuth store entry for stdio)",
       );
     }
-    await clearStoredAuthForRelogin(serverConfig.url);
+    // RFC 7009 (#2144). The flag and the per-server setting are both opt-outs,
+    // so either one turns the revocation off; neither can turn it on for the
+    // other. Reported rather than thrown — `--relogin` is a local delete and
+    // must not start failing because an authorization server is unreachable.
+    const revocation = await clearStoredAuthForRelogin(serverConfig.url, {
+      revoke: revoke && serverSettings?.oauthRevokeOnClear !== false,
+    });
+    if (revocation?.status === "failed") {
+      process.stderr.write(
+        `Warning: could not revoke the OAuth grant at the authorization server (${revocation.detail}); it may still be valid there.\n`,
+      );
+    }
   }
 
   // Version comes from the single source of truth — the root package.json —
@@ -592,6 +604,7 @@ type ParseResult =
       callbackUrl?: string;
       storedAuthOnly?: boolean;
       relogin?: boolean;
+      revoke?: boolean;
     }
   // Short-circuit modes (`--list-stored-auth`, `--print-handoff`) do their own
   // output and need no server connection; runCli returns immediately.
@@ -787,6 +800,10 @@ async function parseArgs(argv?: string[]): Promise<ParseResult> {
       "--relogin",
       "Delete stored OAuth for this server URL from the shared store before connect (HTTP/SSE URL keys only); interactive login runs only if the server requires auth. Rejected for stdio (no URL-keyed store entry)",
     )
+    .option(
+      "--no-revoke",
+      "Requires --relogin. Skips the RFC 7009 revocation request that would otherwise end the grant at the authorization server when the local state is deleted. Also skipped when the server entry sets oauth.revokeOnClear to false.",
+    )
     .option(
       "--wait-for-auth <sec>",
       "Poll the OAuth state file until a token for --server-url appears (or the timeout elapses), then proceed as if --use-stored-auth were set. Use after handing off to a human to complete OAuth in a browser.",
@@ -842,6 +859,7 @@ async function parseArgs(argv?: string[]): Promise<ParseResult> {
     useStoredAuth?: boolean;
     storedAuthOnly?: boolean;
     relogin?: boolean;
+    revoke?: boolean;
     waitForAuth?: number;
     listStoredAuth?: boolean;
     printHandoff?: boolean;
@@ -871,6 +889,15 @@ async function parseArgs(argv?: string[]): Promise<ParseResult> {
     }
   }
 
+  // `--no-revoke` only means anything alongside `--relogin` — it suppresses the
+  // RFC 7009 request that clear makes. Accepted on its own it is inert, and
+  // worse than inert: it reads as "this run will not revoke anything", which is
+  // true only because nothing was going to be cleared. Rejected here, ahead of
+  // the short-circuit returns, for the same reason `--strict` is (#2144).
+  if (options.revoke === false && !options.relogin) {
+    throw new Error("--no-revoke requires --relogin (it has no other effect).");
+  }
+
   // `--strict` is checked HERE, ahead of every short-circuit return below
   // (`--list-stored-auth`, `--print-handoff`, `servers/list`, `servers/show`),
   // rather than beside the other method-shaped validations further down. Those
@@ -1134,6 +1161,9 @@ async function parseArgs(argv?: string[]): Promise<ParseResult> {
     callbackUrl: options.callbackUrl,
     storedAuthOnly: options.storedAuthOnly === true,
     relogin: options.relogin === true,
+    // Commander's `--no-revoke` defaults this to true; only an explicit
+    // `--no-revoke` makes it false.
+    revoke: options.revoke !== false,
   };
 }
 
@@ -1152,6 +1182,7 @@ export async function runCli(argv?: string[]): Promise<void> {
     callbackUrl,
     storedAuthOnly,
     relogin,
+    revoke,
   } = parsed;
   const clientConfig = await loadRunnerClientConfig({ clientConfigPath });
   // A bad --callback-url / MCP_OAUTH_CALLBACK_URL is a *usage* error, but its
@@ -1181,5 +1212,6 @@ export async function runCli(argv?: string[]): Promise<void> {
     callbackUrlConfig,
     storedAuthOnly === true,
     relogin === true,
+    revoke !== false,
   );
 }